US20140379915A1 - Cloud based dynamic access control list management architecture - Google Patents
Cloud based dynamic access control list management architecture Download PDFInfo
- Publication number
- US20140379915A1 US20140379915A1 US14/084,074 US201314084074A US2014379915A1 US 20140379915 A1 US20140379915 A1 US 20140379915A1 US 201314084074 A US201314084074 A US 201314084074A US 2014379915 A1 US2014379915 A1 US 2014379915A1
- Authority
- US
- United States
- Prior art keywords
- access control
- network traffic
- policy
- control list
- router
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H04L29/08009—
Definitions
- the present disclosure generally relates to management of access control lists (ACLs) and networked computer systems.
- ACLs access control lists
- ACL access control lists
- Network administrators are facing large amount of ACL management requirements per device.
- network administrators do not have an effective way to configure, manage, or optimize management of access control lists across a large network.
- the number of access control lists size grow exponentially; hence, access control lists quickly become “out of control” and unmanageable for network administrators.
- Attempts at centralized management of access control lists do not address the needs of enabling network administrators attempting to efficiently manage the large numbers of access control lists, especially since prior attempts still have required administrators to manually configure the access control lists.
- FIG. 1 illustrates an example system having an apparatus configured for creating and managing access control lists for a router, according to an example embodiment.
- FIG. 2 illustrates an example router configured for sending traffic information to a management server and receiving access control list information based on the traffic information, according to an example embodiment.
- FIG. 3 illustrates an example management server configured for receiving traffic information from a router in response to generating access control list information for implementation in the router, according to an example embodiment.
- FIG. 4 illustrates in further detail the packet analysis engine (PAE) of FIG. 3 , according to an example embodiment.
- PAE packet analysis engine
- FIG. 5 illustrates in further detail the rule matching of FIG. 3 , according to an example embodiment.
- FIG. 6 illustrates an example method of a router requesting and receiving an access control list policy for network traffic having been received by the router, according to an example embodiment.
- FIG. 7 illustrates an example method of a management server determining an access control list policy requested by a router, according to an example embodiment.
- a method comprises receiving, by a router, network traffic having been generated by one or more client devices; parsing information from the network traffic; forwarding the information associated with the network traffic to an access control list management server; receiving, from the access control list management server, policy values describing an access control list policy associated with the network traffic; and implementing the policy values for enforcement of the access control list policy by the router.
- a method comprises receiving, from a router, information associated with network traffic having been received by the router; determining an access control list policy for the network traffic based on the information; and sending to the router policy values describing the access control list policy, for implementation and enforcement of the access control list policy by the router.
- Particular embodiments use a cloud based architecture to dynamically create/delete/manage access control lists (ACLs) that manage admission control policies for network traffic generated by user devices (e.g., personal computers, intelligent tablet devices, intelligent mobile phones, etc.), and also generate ACL recommendations for network administrators.
- ACLs access control lists
- example embodiments enable dynamic generation of access control lists by a centralized management server, based on the centralized management server obtaining information associated with network traffic having been received by a router.
- the centralized management server can determine an access control list policy for the network traffic based on the information and prescribed policies available to the centralized management server, and can dynamically generate policy values that describe the access control list policy, enabling the router to implement and enforce the access control list policy.
- the centralized management server also can generate a proposed access control list policy, and submit a recommendation specifying the proposed access control list policy to a network administrator for confirmation.
- the example embodiments enable dynamic creation and management of access control lists based on existing network traffic, eliminating the necessity of manual configuration of network devices (e.g., network switches or network routers) by network administrators.
- network devices e.g., network switches or network routers
- FIG. 1 illustrates an example system 10 having an apparatus 12 for creating and managing access control lists with one or more network routers 14 via a local area network (LAN) and/or wide area network (WAN) 16 , according to an example embodiment.
- Each apparatus 12 and 14 is a physical machine (i.e., hardware device) configured for implementing network communications with other physical machines via the network 16 .
- the wide-area network 16 can be implemented for example as a private wide-area network which can use at least a portion of the Internet.
- FIG. 2 illustrates an example router 14 configured for sending traffic information to a management server and receiving access control list information based on the traffic information, according to an example embodiment.
- the router 14 can include one or more network interface circuits 20 and one or more processor circuits 22 that can implement an agent module 24 and an access control list (ACL) module 26 .
- ACL access control list
- the network interface circuit 20 can be configured for receiving network traffic 28 in operation 29 of FIG. 6 in the form of flows of data packets having been generated by one or more client devices ( 30 of FIG. 1 ), for example personal computers, laptops computers, intelligent tablet, intelligent mobile phones, etc. via wired or wireless connections.
- client devices 30 of FIG. 1
- the network interface circuit 20 can forward the network traffic 28 to the agent module 24 .
- the agent module 24 can be implemented as an application-specific integrated circuit (ASIC), a software-based executable resource executed by the processor circuit 22 , and/or a combination thereof.
- a traffic listener 32 within the agent module 24 can capture the first packet of the network traffic 28 and identify it with an interface identifier associated with the network interface circuit 20 in operation 34 .
- a communication and control module 36 in the agent module 24 can forward the packet captured by the traffic listener 32 as information 38 to the management server 12 via the wide-area network 16 of FIG. 1 ; hence, the information 38 sent to the management server 12 can specify the data packet captured by the traffic listener, the interface identifier, and an identifier for the router 12 .
- the centralized ACL management server 12 can return to the communication and control module 36 in operation 40 policy values 42 that describe an access control list policy determined by the ACL management server 12 based on the information 38 from the router 14 .
- a policy summarization module 44 can determine in operation 48 whether the determined network policy as defined by the policy values 42 can be summarized with any existing policy stored in a local policy repository 46 , implemented for example as a machine-readable memory circuit.
- the policy summarization module 44 can return in operation 48 a policy decision 50 to the communication and control module 36 , which can forward the policy decision 50 in operation 52 to an ACL auditing module 54 .
- the ACL auditing module 54 can perform auditing operations (e.g., “sanity checks”), and in response cause an ACL management module 56 to format the policies 58 .
- the formatted policies 60 are sent to the ACL module 26 which generates in operation 61 the final access control lists 62 .
- the ACL module 26 can collect all statistics data on generated access control lists (ACLs) 62 .
- the ACL management module 56 can maintain the life cycle of ACLs 62 based on the statistics data collected by the ACL module 26 .
- the access control lists 62 generated by the ACL module 26 are applied to the inbound and outbound interfaces 20 .
- Network traffic 28 from the interface 20 can be analyzed with respect to the ACL maintained in the ACL module 26 : if a given data packet in the network 28 is the first (i.e., initial) packet of a data flow, the data packet can be captured by the traffic listener 32 . If the data packet is subsequent to the initial data packet in the data flow, the event of receiving the packet is recorded by the ACL module 26 based on updating ACL statistics associated with the corresponding ACL 62 , for example tracking hit count and generating traffic statistics based on the live traffic relative to the ACLs 62 .
- the ACL statistics can be used by the ACL management module 56 to maintain the life cycle of the ACL 62 , for example based on placing the ACL 62 in a suspended state after expiration after a prescribed interval (e.g., an idle interval), enabling the ACL 62 to resume if the traffic flow 28 resumes.
- a prescribed interval e.g., an idle interval
- the ACL management module 56 also can determine based on local routing tables which interface should apply the dynamically generated ACLs 62 .
- FIG. 3 illustrates an example implementation of a cloud-based access control list (ACL) management server 12 , according to an example embodiment.
- the server 12 implemented for example in a data center providing cloud-based computing services, can include a network interface circuit 70 , also referred to as a communication module, and one or more processor circuits 72 .
- the processor circuit 72 can implement a packet analysis engine (PAE) 74 , and ACL policy module (APM) 76 and a graphic user interface (GUI) based management platform 78 .
- the server 12 also can access an event management database (EMDB) 80 , a rule database 82 , and a traffic categorization database 84 which can be implemented as a built-in database or an external third-party database.
- EMDB event management database
- the communication module 70 can receive, from the router 14 in operation 85 of FIG. 7 , information 86 associated with network traffic having been received by the router 14 : the information 86 can include a copy of a received data packet, a router identifier, and an interface identifier.
- a message distributor 88 in the communication module 70 can add the information 86 into a message queue (e.g., a first in first out (FIFO) queue), and can send the first available information message 86 to a notification handler 90 in the communication module 70 .
- the notification handler 90 can inform the packet analysis engine module 74 of the network traffic information 86 , including packet header, router identifier, interface identifier, etc.
- a packet categorization and analysis module 92 can analyze the information 86 and disassemble the received data packet, and can either query an external database or internal database 84 in order to categorize the received data packet in operation 93 according to prescribed categorization parameters and network traffic type.
- the packet analysis engine in operation 94 can format the query result, and update a local event management database (EMDB) 80 in operation 95 .
- EMDB local event management database
- the packet analysis engine 74 can forward the query result 96 to the ACL policy module (APM) 76 .
- a rule matching process 98 in the APM 76 can identify the best access control list policy based on a correlation relative to stored access control list policies; for example, the rule matching process 98 can query the rule database 82 to find a matching access control list policy: if a single ACL policy is found in operation 101 , the determined ACL policy 110 can be output in operation 106 ; if in operation 100 multiple matches are found, the APM 76 can select the highest confidence policy (best match) in operation 102 , and append in operation 104 any customized conditions that are needed.
- the event management database 80 can be queried by the APM 76 to identify the closest historic decision in operation 162 (described below).
- the APM 76 can send any acknowledgment or deny message, or send the determined ACL policy 110 in operation 106 to the policy handler 130 .
- a notification 108 also can be sent by the APM 76 to the management platform 78 , enabling a network administrator ( 112 of FIG. 1 ) to approve, reject, or modify the recommendation generated by the APM 76 .
- the APM 76 can update the EMDB 80 in response to the administrator action 120 , such that the same flow can be allowed for subsequent instances of the same network traffic 28 if the administrator approves the recommendation.
- the policy handler 130 in the communication module 70 can format the policy decision 110 into router policy values 132 describing the access control list policy 110 , wherein the message distributor 134 can send the message containing the router policy values 132 to the router 14 .
- FIG. 4 illustrates in further detail the packet analysis engine (PAE) 74 of FIG. 3 , according to an example embodiment.
- An incoming packet 140 is disassembled by a packets disassemble component 142 which can retrieve basic information such as Internet protocol (IP) addresses including source address, destination address, source and destination TCP/UDP ports, timestamps, etc.
- IP Internet protocol
- a database query component 144 can format the information retrieved by the packets disassemble component 142 in order to query the database 84 .
- the database can be any type of database, for example a commercially available Cisco Intrusion Prevention System (IPS) database, a wireshark database as described at the website address “http://www.wireshark.org/”, or any external database which can help categorize packets.
- IPS Cisco Intrusion Prevention System
- the server 12 can leverage external databases such as a Cisco IPS database, wireshark traffic database, etc., to categorize network traffic; as described in further detail below, the categorization with the highest confidence value “wins” the database query and is returned as the query results.
- the categorization component 146 can format the query results, enabling updating the EMDB database 80 of FIG. 3 by the configuration component 94 .
- the message component 148 can forward the query results to the APM 76 for further analysis.
- FIG. 5 illustrates in further detail the rule matching process 98 of FIG. 3 , according to an example embodiment.
- the rule matching process 98 can query in operation 150 the rules database 82 of FIG. 3 : if in operation 152 there is a rule match, all the matched rules are returned to module 102 , which can comprise a rules selection reasoning module 154 and a classifier module 156 .
- the rule selection reasoning module 154 can engage the classifier module 156 to calculate a confidence level of each matched rule, or the popularity level of each matched rule.
- the server 12 can maintain the EMDB 80 and track the usage of each policy; hence, the ACL server 12 can calculate and maintain the popularity value of each policy.
- the popularity value of each policy can thus expedite the policy selection process.
- the highest level rule will be selected as the best matched rule and sent to configure the EMDB 80 in operation 157 . If in operation 104 a a condition is set with the chosen rule (e.g., “if ACL has no hit counts for 30 days, then delete”), then append the condition value in operation 104 b to the best matched rule and send in operation 160 the policy 110 to the communication module 70 .
- the EMDB 80 can be queried in an attempt to return the highest popularity level rule as a system recommendation in operation 164 (a “deny” 166 also can be sent to the communication module 70 to acknowledge the request).
- a notification 170 also can be sent to the admin interface 78 regarding the recommended rule, enabling the network administrator 112 to manually approve, deny, or modify the rule.
- the feedback 120 from the network administrator 112 will be updated to the EMDB database 80 for future reference.
- the example embodiments implement learning in the 14 router to generate statistics, and summarize the traffic into different patterns, and then forward the packet to the central server.
- the central server can then determine an ACL decision based on policies, and push the ACL decision to the router; hence, ACL management for a large number of network devices can be managed in a scalable manner.
- any of the disclosed circuits of machines 12 or 14 can be implemented in multiple forms.
- Example implementations of the disclosed circuits include hardware logic that is implemented in a logic array such as a programmable logic array (PLA), a field programmable gate array (FPGA), or by mask programming of integrated circuits such as an application-specific integrated circuit (ASIC).
- PLA programmable logic array
- FPGA field programmable gate array
- ASIC application-specific integrated circuit
- any of these circuits also can be implemented using a software-based executable resource that is executed by a corresponding internal processor circuit such as a microprocessor circuit (not shown) and implemented using one or more integrated circuits, where execution of executable code stored in an internal memory circuit causes the integrated circuit(s) implementing the processor circuit to store application state variables in processor memory, creating an executable application resource (e.g., an application instance) that performs the operations of the circuit as described herein.
- a software-based executable resource that is executed by a corresponding internal processor circuit such as a microprocessor circuit (not shown) and implemented using one or more integrated circuits, where execution of executable code stored in an internal memory circuit causes the integrated circuit(s) implementing the processor circuit to store application state variables in processor memory, creating an executable application resource (e.g., an application instance) that performs the operations of the circuit as described herein.
- circuit refers to both a hardware-based circuit implemented using one or more integrated circuits and that includes logic for performing the described operations, or a software-based circuit that includes a processor circuit (implemented using one or more integrated circuits), the processor circuit including a reserved portion of processor memory for storage of application state data and application variables that are modified by execution of the executable code by a processor circuit.
- a memory circuit can be implemented, for example, using a non-volatile memory such as a programmable read only memory (PROM) or an EPROM, and/or a volatile memory such as a DRAM, etc.
- any reference to “outputting a message” or “outputting a packet” can be implemented based on creating the message/packet in the form of a data structure and storing that data structure in a tangible memory medium in the disclosed apparatus (e.g., in a transmit buffer).
- Any reference to “outputting a message” or “outputting a packet” (or the like) also can include electrically transmitting (e.g., via wired electric current or wireless electric field, as appropriate) the message/packet stored in the tangible memory medium to another network node via a communications medium (e.g., a wired or wireless link, as appropriate) (optical transmission also can be used, as appropriate).
- any reference to “receiving a message” or “receiving a packet” can be implemented based on the disclosed apparatus detecting the electrical (or optical) transmission of the message/packet on the communications medium, and storing the detected transmission as a data structure in a tangible memory medium in the disclosed apparatus (e.g., in a receive buffer).
- any memory circuit can be implemented dynamically by the processor circuit, for example based on memory address assignment and partitioning executed by the processor circuit.
- any of the Figures can be implemented as executable code stored on a computer or machine readable non-transitory tangible storage medium (e.g., floppy disk, hard disk, ROM, EEPROM, nonvolatile RAM, CD-ROM, etc.) that are completed based on execution of the code by a processor circuit implemented using one or more integrated circuits; the operations described herein also can be implemented as executable logic that is encoded in one or more non-transitory tangible media for execution (e.g., programmable logic arrays or devices, field programmable gate arrays, programmable array logic, application specific integrated circuits, etc.).
- executable code stored on a computer or machine readable non-transitory tangible storage medium (e.g., floppy disk, hard disk, ROM, EEPROM, nonvolatile RAM, CD-ROM, etc.) that are completed based on execution of the code by a processor circuit implemented using one or more integrated circuits; the operations described herein also can be implemented as executable logic that is encoded in one
Landscapes
- Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
In one embodiment, a method comprises receiving, by a router, network traffic having been generated by one or more client devices; parsing information from the network traffic; forwarding the information associated with the network traffic to an access control list management server; receiving, from the access control list management server, policy values describing an access control list policy associated with the network traffic; and implementing the policy values for enforcement of the access control list policy by the router.
Description
- This application claims priority from Provisional Application No. 61/836,960, filed Jun. 19, 2013.
- The present disclosure generally relates to management of access control lists (ACLs) and networked computer systems.
- This section describes approaches that could be employed, but are not necessarily approaches that have been previously conceived or employed. Hence, unless explicitly specified otherwise, any approaches described in this section are not prior art to the claims in this application, and any approaches described in this section are not admitted to be prior art by inclusion in this section.
- Management of access control lists (ACL) invariably causes numerous difficulties for large enterprise-sized networks. Network administrators are facing large amount of ACL management requirements per device. Hence, network administrators do not have an effective way to configure, manage, or optimize management of access control lists across a large network. Hence, the number of access control lists size grow exponentially; hence, access control lists quickly become “out of control” and unmanageable for network administrators. Attempts at centralized management of access control lists do not address the needs of enabling network administrators attempting to efficiently manage the large numbers of access control lists, especially since prior attempts still have required administrators to manually configure the access control lists.
- Reference is made to the attached drawings, wherein elements having the same reference numeral designations represent like elements throughout and wherein:
-
FIG. 1 illustrates an example system having an apparatus configured for creating and managing access control lists for a router, according to an example embodiment. -
FIG. 2 illustrates an example router configured for sending traffic information to a management server and receiving access control list information based on the traffic information, according to an example embodiment. -
FIG. 3 illustrates an example management server configured for receiving traffic information from a router in response to generating access control list information for implementation in the router, according to an example embodiment. -
FIG. 4 illustrates in further detail the packet analysis engine (PAE) ofFIG. 3 , according to an example embodiment. -
FIG. 5 illustrates in further detail the rule matching ofFIG. 3 , according to an example embodiment. -
FIG. 6 illustrates an example method of a router requesting and receiving an access control list policy for network traffic having been received by the router, according to an example embodiment. -
FIG. 7 illustrates an example method of a management server determining an access control list policy requested by a router, according to an example embodiment. - In one embodiment, a method comprises receiving, by a router, network traffic having been generated by one or more client devices; parsing information from the network traffic; forwarding the information associated with the network traffic to an access control list management server; receiving, from the access control list management server, policy values describing an access control list policy associated with the network traffic; and implementing the policy values for enforcement of the access control list policy by the router.
- In another embodiment, a method comprises receiving, from a router, information associated with network traffic having been received by the router; determining an access control list policy for the network traffic based on the information; and sending to the router policy values describing the access control list policy, for implementation and enforcement of the access control list policy by the router.
- Particular embodiments use a cloud based architecture to dynamically create/delete/manage access control lists (ACLs) that manage admission control policies for network traffic generated by user devices (e.g., personal computers, intelligent tablet devices, intelligent mobile phones, etc.), and also generate ACL recommendations for network administrators. In particular, example embodiments enable dynamic generation of access control lists by a centralized management server, based on the centralized management server obtaining information associated with network traffic having been received by a router. The centralized management server can determine an access control list policy for the network traffic based on the information and prescribed policies available to the centralized management server, and can dynamically generate policy values that describe the access control list policy, enabling the router to implement and enforce the access control list policy. If necessary, the centralized management server also can generate a proposed access control list policy, and submit a recommendation specifying the proposed access control list policy to a network administrator for confirmation.
- Hence, the example embodiments enable dynamic creation and management of access control lists based on existing network traffic, eliminating the necessity of manual configuration of network devices (e.g., network switches or network routers) by network administrators.
-
FIG. 1 illustrates anexample system 10 having anapparatus 12 for creating and managing access control lists with one ormore network routers 14 via a local area network (LAN) and/or wide area network (WAN) 16, according to an example embodiment. Eachapparatus network 16. The wide-area network 16 can be implemented for example as a private wide-area network which can use at least a portion of the Internet. -
FIG. 2 illustrates anexample router 14 configured for sending traffic information to a management server and receiving access control list information based on the traffic information, according to an example embodiment. Therouter 14 can include one or morenetwork interface circuits 20 and one ormore processor circuits 22 that can implement anagent module 24 and an access control list (ACL)module 26. - The
network interface circuit 20 can be configured for receivingnetwork traffic 28 inoperation 29 ofFIG. 6 in the form of flows of data packets having been generated by one or more client devices (30 ofFIG. 1 ), for example personal computers, laptops computers, intelligent tablet, intelligent mobile phones, etc. via wired or wireless connections. In response to thenetwork traffic 28 flowing into thenetwork interface circuit 20, thenetwork interface circuit 20 can forward thenetwork traffic 28 to theagent module 24. Theagent module 24 can be implemented as an application-specific integrated circuit (ASIC), a software-based executable resource executed by theprocessor circuit 22, and/or a combination thereof. Atraffic listener 32 within theagent module 24 can capture the first packet of thenetwork traffic 28 and identify it with an interface identifier associated with thenetwork interface circuit 20 inoperation 34. A communication andcontrol module 36 in theagent module 24 can forward the packet captured by thetraffic listener 32 asinformation 38 to themanagement server 12 via the wide-area network 16 ofFIG. 1 ; hence, theinformation 38 sent to themanagement server 12 can specify the data packet captured by the traffic listener, the interface identifier, and an identifier for therouter 12. - As described in further detail below, the centralized
ACL management server 12 can return to the communication andcontrol module 36 inoperation 40policy values 42 that describe an access control list policy determined by theACL management server 12 based on theinformation 38 from therouter 14. Apolicy summarization module 44 can determine inoperation 48 whether the determined network policy as defined by thepolicy values 42 can be summarized with any existing policy stored in alocal policy repository 46, implemented for example as a machine-readable memory circuit. Thepolicy summarization module 44 can return in operation 48 apolicy decision 50 to the communication andcontrol module 36, which can forward thepolicy decision 50 inoperation 52 to anACL auditing module 54. TheACL auditing module 54 can perform auditing operations (e.g., “sanity checks”), and in response cause anACL management module 56 to format thepolicies 58. The formattedpolicies 60 are sent to theACL module 26 which generates inoperation 61 the finalaccess control lists 62. In particular, theACL module 26 can collect all statistics data on generated access control lists (ACLs) 62. TheACL management module 56 can maintain the life cycle ofACLs 62 based on the statistics data collected by theACL module 26. The access control lists 62 generated by theACL module 26 are applied to the inbound andoutbound interfaces 20.Network traffic 28 from theinterface 20 can be analyzed with respect to the ACL maintained in the ACL module 26: if a given data packet in thenetwork 28 is the first (i.e., initial) packet of a data flow, the data packet can be captured by thetraffic listener 32. If the data packet is subsequent to the initial data packet in the data flow, the event of receiving the packet is recorded by theACL module 26 based on updating ACL statistics associated with thecorresponding ACL 62, for example tracking hit count and generating traffic statistics based on the live traffic relative to theACLs 62. The ACL statistics can be used by theACL management module 56 to maintain the life cycle of theACL 62, for example based on placing theACL 62 in a suspended state after expiration after a prescribed interval (e.g., an idle interval), enabling theACL 62 to resume if the traffic flow 28 resumes. Note that theACL management module 56 also can determine based on local routing tables which interface should apply the dynamically generatedACLs 62. -
FIG. 3 illustrates an example implementation of a cloud-based access control list (ACL)management server 12, according to an example embodiment. Theserver 12, implemented for example in a data center providing cloud-based computing services, can include anetwork interface circuit 70, also referred to as a communication module, and one ormore processor circuits 72. Theprocessor circuit 72 can implement a packet analysis engine (PAE) 74, and ACL policy module (APM) 76 and a graphic user interface (GUI) basedmanagement platform 78. Theserver 12 also can access an event management database (EMDB) 80, arule database 82, and a traffic categorization database 84 which can be implemented as a built-in database or an external third-party database. - The
communication module 70 can receive, from therouter 14 inoperation 85 ofFIG. 7 ,information 86 associated with network traffic having been received by the router 14: theinformation 86 can include a copy of a received data packet, a router identifier, and an interface identifier. Amessage distributor 88 in thecommunication module 70 can add theinformation 86 into a message queue (e.g., a first in first out (FIFO) queue), and can send the firstavailable information message 86 to anotification handler 90 in thecommunication module 70. Thenotification handler 90 can inform the packetanalysis engine module 74 of thenetwork traffic information 86, including packet header, router identifier, interface identifier, etc. A packet categorization andanalysis module 92 can analyze theinformation 86 and disassemble the received data packet, and can either query an external database or internal database 84 in order to categorize the received data packet inoperation 93 according to prescribed categorization parameters and network traffic type. The packet analysis engine inoperation 94 can format the query result, and update a local event management database (EMDB) 80 inoperation 95. - The
packet analysis engine 74 can forward thequery result 96 to the ACL policy module (APM) 76. Arule matching process 98 in the APM 76 can identify the best access control list policy based on a correlation relative to stored access control list policies; for example, therule matching process 98 can query therule database 82 to find a matching access control list policy: if a single ACL policy is found inoperation 101, thedetermined ACL policy 110 can be output inoperation 106; if inoperation 100 multiple matches are found, the APM 76 can select the highest confidence policy (best match) inoperation 102, and append inoperation 104 any customized conditions that are needed. - If in
operation 100 the matching process returns a “null” (i.e., no matches are found), theevent management database 80 can be queried by the APM 76 to identify the closest historic decision in operation 162 (described below). TheAPM 76 can send any acknowledgment or deny message, or send thedetermined ACL policy 110 inoperation 106 to thepolicy handler 130. Anotification 108 also can be sent by theAPM 76 to themanagement platform 78, enabling a network administrator (112 ofFIG. 1 ) to approve, reject, or modify the recommendation generated by theAPM 76. - The
APM 76 can update theEMDB 80 in response to theadministrator action 120, such that the same flow can be allowed for subsequent instances of thesame network traffic 28 if the administrator approves the recommendation. - The
policy handler 130 in thecommunication module 70 can format thepolicy decision 110 into router policy values 132 describing the accesscontrol list policy 110, wherein themessage distributor 134 can send the message containing the router policy values 132 to therouter 14. -
FIG. 4 illustrates in further detail the packet analysis engine (PAE) 74 ofFIG. 3 , according to an example embodiment. Anincoming packet 140 is disassembled by a packets disassemblecomponent 142 which can retrieve basic information such as Internet protocol (IP) addresses including source address, destination address, source and destination TCP/UDP ports, timestamps, etc. Adatabase query component 144 can format the information retrieved by the packets disassemblecomponent 142 in order to query the database 84. The database can be any type of database, for example a commercially available Cisco Intrusion Prevention System (IPS) database, a wireshark database as described at the website address “http://www.wireshark.org/”, or any external database which can help categorize packets. Hence, based on the traffic received from the network, theserver 12 can leverage external databases such as a Cisco IPS database, wireshark traffic database, etc., to categorize network traffic; as described in further detail below, the categorization with the highest confidence value “wins” the database query and is returned as the query results. Thecategorization component 146 can format the query results, enabling updating theEMDB database 80 ofFIG. 3 by theconfiguration component 94. Themessage component 148 can forward the query results to theAPM 76 for further analysis. -
FIG. 5 illustrates in further detail therule matching process 98 ofFIG. 3 , according to an example embodiment. In response to receiving themessage 96 from thePAE 74, therule matching process 98 can query inoperation 150 therules database 82 ofFIG. 3 : if inoperation 152 there is a rule match, all the matched rules are returned tomodule 102, which can comprise a rulesselection reasoning module 154 and aclassifier module 156. The ruleselection reasoning module 154 can engage theclassifier module 156 to calculate a confidence level of each matched rule, or the popularity level of each matched rule. Based on the traffic pattern seen from the network by therouter 14, theserver 12 can maintain theEMDB 80 and track the usage of each policy; hence, theACL server 12 can calculate and maintain the popularity value of each policy. The popularity value of each policy can thus expedite the policy selection process. The highest level rule will be selected as the best matched rule and sent to configure the EMDB 80 inoperation 157. If inoperation 104 a a condition is set with the chosen rule (e.g., “if ACL has no hit counts for 30 days, then delete”), then append the condition value inoperation 104 b to the best matched rule and send inoperation 160 thepolicy 110 to thecommunication module 70. - If in
operation 152 the matched rule query returns a “null”, then inoperation 162 theEMDB 80 can be queried in an attempt to return the highest popularity level rule as a system recommendation in operation 164 (a “deny” 166 also can be sent to thecommunication module 70 to acknowledge the request). Anotification 170 also can be sent to theadmin interface 78 regarding the recommended rule, enabling thenetwork administrator 112 to manually approve, deny, or modify the rule. Thefeedback 120 from thenetwork administrator 112 will be updated to theEMDB database 80 for future reference. - Hence, the example embodiments implement learning in the 14 router to generate statistics, and summarize the traffic into different patterns, and then forward the packet to the central server. The central server can then determine an ACL decision based on policies, and push the ACL decision to the router; hence, ACL management for a large number of network devices can be managed in a scalable manner.
- Any of the disclosed circuits of
machines 12 or 14 (including the network interface circuit, any memory circuit, and any processor circuit, and their associated components) can be implemented in multiple forms. Example implementations of the disclosed circuits include hardware logic that is implemented in a logic array such as a programmable logic array (PLA), a field programmable gate array (FPGA), or by mask programming of integrated circuits such as an application-specific integrated circuit (ASIC). Any of these circuits also can be implemented using a software-based executable resource that is executed by a corresponding internal processor circuit such as a microprocessor circuit (not shown) and implemented using one or more integrated circuits, where execution of executable code stored in an internal memory circuit causes the integrated circuit(s) implementing the processor circuit to store application state variables in processor memory, creating an executable application resource (e.g., an application instance) that performs the operations of the circuit as described herein. Hence, use of the term “circuit” in this specification refers to both a hardware-based circuit implemented using one or more integrated circuits and that includes logic for performing the described operations, or a software-based circuit that includes a processor circuit (implemented using one or more integrated circuits), the processor circuit including a reserved portion of processor memory for storage of application state data and application variables that are modified by execution of the executable code by a processor circuit. A memory circuit can be implemented, for example, using a non-volatile memory such as a programmable read only memory (PROM) or an EPROM, and/or a volatile memory such as a DRAM, etc. - Further, any reference to “outputting a message” or “outputting a packet” (or the like) can be implemented based on creating the message/packet in the form of a data structure and storing that data structure in a tangible memory medium in the disclosed apparatus (e.g., in a transmit buffer). Any reference to “outputting a message” or “outputting a packet” (or the like) also can include electrically transmitting (e.g., via wired electric current or wireless electric field, as appropriate) the message/packet stored in the tangible memory medium to another network node via a communications medium (e.g., a wired or wireless link, as appropriate) (optical transmission also can be used, as appropriate). Similarly, any reference to “receiving a message” or “receiving a packet” (or the like) can be implemented based on the disclosed apparatus detecting the electrical (or optical) transmission of the message/packet on the communications medium, and storing the detected transmission as a data structure in a tangible memory medium in the disclosed apparatus (e.g., in a receive buffer). Also note that any memory circuit can be implemented dynamically by the processor circuit, for example based on memory address assignment and partitioning executed by the processor circuit.
- The operations described in any of the Figures can be implemented as executable code stored on a computer or machine readable non-transitory tangible storage medium (e.g., floppy disk, hard disk, ROM, EEPROM, nonvolatile RAM, CD-ROM, etc.) that are completed based on execution of the code by a processor circuit implemented using one or more integrated circuits; the operations described herein also can be implemented as executable logic that is encoded in one or more non-transitory tangible media for execution (e.g., programmable logic arrays or devices, field programmable gate arrays, programmable array logic, application specific integrated circuits, etc.).
- In addition, the operations described with respect to any of the Figures can be performed in any suitable order, or at least some of the operations in parallel. Execution of the operations as described herein is by way of illustration only; as such, the operations do not necessarily need to be executed by the machine-based hardware components as described herein; to the contrary, other machine-based hardware components can be used to execute the disclosed operations in any appropriate order, or at least some of the operations in parallel.
- While the example embodiments in the present disclosure have been described in connection with what is presently considered to be the best mode for carrying out the subject matter specified in the appended claims, it is to be understood that the example embodiments are only illustrative, and are not to restrict the subject matter specified in the appended claims.
Claims (20)
1. A method comprising:
receiving, by a router, network traffic having been generated by one or more client devices;
parsing information from the network traffic;
forwarding the information associated with the network traffic to an access control list management server;
receiving, from the access control list management server, policy values describing an access control list policy associated with the network traffic; and
implementing the policy values for enforcement of the access control list policy by the router.
2. The method of claim 1 , wherein the parsing includes capturing a data packet from the network traffic, the forwarding including specifying, within the information, the data packet, an interface identifier associated with reception of the network traffic, and a router identifier.
3. The method of claim 1 , wherein the implementing includes:
determining whether the policy values can be summarized with existing policies, and generating a corresponding policy decision; and
generating access control lists, based on the policy decision, for execution by network interfaces in the router.
4. An apparatus comprising:
a network interface circuit configured for receiving network traffic having been generated by one or more client devices; and
a processor circuit configured for:
parsing information from the network traffic, and forwarding the information associated with the network traffic to an access control list management server,
receiving, from the access control list management server, policy values describing an access control list policy associated with the network traffic, and
implementing the policy values within the network interface circuit for enforcement of the access control list policy.
5. The apparatus of claim 4 , wherein the parsing includes capturing a data packet from the network traffic, the forwarding including specifying, within the information, the data packet, an interface identifier associated with reception of the network traffic, and a router identifier.
6. The apparatus of claim 4 , wherein the implementing includes:
determining whether the policy values can be summarized with existing policies, and generating a corresponding policy decision; and
generating access control lists, based on the policy decision, for execution by network interfaces in the router.
7. Logic encoded in one or more non-transitory tangible media for execution by a machine and when executed by the machine operable for:
receiving, by the machine, network traffic having been generated by one or more client devices;
parsing information from the network traffic;
forwarding the information associated with the network traffic to an access control list management server;
receiving, from the access control list management server, policy values describing an access control list policy associated with the network traffic; and
implementing the policy values for enforcement of the access control list policy by the machine.
8. The logic of claim 7 , wherein the parsing includes capturing a data packet from the network traffic, the forwarding including specifying, within the information, the data packet, an interface identifier associated with reception of the network traffic, and a router identifier.
9. The logic of claim 7 , wherein the implementing includes:
determining whether the policy values can be summarized with existing policies, and generating a corresponding policy decision; and
generating access control lists, based on the policy decision, for execution by network interfaces in the router.
10. A method comprising:
receiving, from a router, information associated with network traffic having been received by the router;
determining an access control list policy for the network traffic based on the information; and
sending to the router policy values describing the access control list policy, for implementation and enforcement of the access control list policy by the router.
11. The method of claim 10 , wherein the determining includes:
categorizing the network traffic according to network traffic type; and
identifying the access control list policy for the network traffic according to network traffic type, based on a correlation relative to stored access control list policies.
12. The method of claim 11 , wherein the identifying includes:
determining whether a best match exists based on determining whether one or more matching access control list policies is located for the network traffic according to the network traffic type;
if no matching access control list policies are located, determining a closest historic decision for an access control list as the access control list policy for the router, based on sending a query to an event management database configured for storing events and associated policy decisions.
13. The method of claim 12 , wherein determining a best match includes applying at least one of a rule selection reasoning, a highest confidence level, or a popularity level rule for choosing the access control list policy if multiple matching access control list policies are located for the network traffic.
14. The method of claim 10 , further comprising:
notifying an event management database of the network traffic having been received by the router, the event management database storing historical policy decisions for respective network traffic events;
the determining including determining from the event management database if a closest historic decision is available for the network traffic having been received by the router, based on a determined absence of a matching access control list policy in a rules database configured for storing rules for access control list policies
the determining further including notifying the event management database of the access control list policy determined for the network traffic having been received by the router.
15. Logic encoded in one or more non-transitory tangible media for execution by a machine and when executed by the machine operable for:
receiving, from a router, information associated with network traffic having been received by the router;
determining an access control list policy for the network traffic based on the information; and
sending to the router policy values describing the access control list policy, for implementation and enforcement of the access control list policy by the router.
16. The logic of claim 15 , wherein the determining includes:
categorizing the network traffic according to network traffic type,
identifying the access control list policy for the network traffic according to network traffic type, based on a correlation relative to stored access control list policies.
17. The logic of claim 16 , wherein the identifying includes:
determining whether a best match exists based on determining whether one or more matching access control list policies is located for the network traffic according to the network traffic type;
if no matching access control list policies are located, determining a closest historic decision for an access control list as the access control list policy for the router, based on sending a query to an event management database configured for storing events and associated policy decisions.
18. The logic of claim 17 , wherein determining a best match includes applying at least one of a rule selection reasoning, a highest confidence level, or a popularity level rule for choosing the access control list policy if multiple matching access control list policies are located for the network traffic.
19. The logic of claim 15 , further operable for:
notifying an event management database of the network traffic having been received by the router, the event management database storing historical policy decisions for respective network traffic events;
the determining further including notifying the event management database of the access control list policy determined for the network traffic having been received by the router.
20. The logic of claim 19 , wherein the determining further includes including determining from the event management database if a closest historic decision is available for the network traffic having been received by the router, based on a determined absence of a matching access control list policy in a rules database configured for storing rules for access control list policies.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14/084,074 US20140379915A1 (en) | 2013-06-19 | 2013-11-19 | Cloud based dynamic access control list management architecture |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201361836960P | 2013-06-19 | 2013-06-19 | |
US14/084,074 US20140379915A1 (en) | 2013-06-19 | 2013-11-19 | Cloud based dynamic access control list management architecture |
Publications (1)
Publication Number | Publication Date |
---|---|
US20140379915A1 true US20140379915A1 (en) | 2014-12-25 |
Family
ID=52111903
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/084,074 Abandoned US20140379915A1 (en) | 2013-06-19 | 2013-11-19 | Cloud based dynamic access control list management architecture |
Country Status (1)
Country | Link |
---|---|
US (1) | US20140379915A1 (en) |
Cited By (85)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20150181642A1 (en) * | 2013-12-19 | 2015-06-25 | Centurylink Intellectual Property Llc | Ubiquitous In-Cloud Microsite Generator for High Speed Data Customer Intake and Activation |
US20150288693A1 (en) * | 2014-04-04 | 2015-10-08 | International Business Machines Corporation | Validation of a location resource based on recipient access |
US20160021037A1 (en) * | 2014-07-18 | 2016-01-21 | International Business Machines Corporation | Recommendation of a location resource based on recipient access |
US20160134522A1 (en) * | 2013-07-15 | 2016-05-12 | Huawei Technologies Co., Ltd. | Data flow processing method, device, and system |
US9509700B2 (en) * | 2014-04-09 | 2016-11-29 | Dell Products L.P. | Access control list lockout prevention system |
US20170295181A1 (en) * | 2016-04-08 | 2017-10-12 | Balaji PARIMI | Activity based access control in heterogeneous environments |
US10043030B1 (en) | 2015-02-05 | 2018-08-07 | Amazon Technologies, Inc. | Large-scale authorization data collection and aggregation |
US10122757B1 (en) * | 2014-12-17 | 2018-11-06 | Amazon Technologies, Inc. | Self-learning access control policies |
US10218572B2 (en) | 2017-06-19 | 2019-02-26 | Cisco Technology, Inc. | Multiprotocol border gateway protocol routing validation |
US10333833B2 (en) | 2017-09-25 | 2019-06-25 | Cisco Technology, Inc. | Endpoint path assurance |
US10333787B2 (en) | 2017-06-19 | 2019-06-25 | Cisco Technology, Inc. | Validation of L3OUT configuration for communications outside a network |
US10341184B2 (en) | 2017-06-19 | 2019-07-02 | Cisco Technology, Inc. | Validation of layer 3 bridge domain subnets in in a network |
US10348564B2 (en) | 2017-06-19 | 2019-07-09 | Cisco Technology, Inc. | Validation of routing information base-forwarding information base equivalence in a network |
US10411996B2 (en) | 2017-06-19 | 2019-09-10 | Cisco Technology, Inc. | Validation of routing information in a network fabric |
US10432467B2 (en) | 2017-06-19 | 2019-10-01 | Cisco Technology, Inc. | Network validation between the logical level and the hardware level of a network |
US10439875B2 (en) | 2017-05-31 | 2019-10-08 | Cisco Technology, Inc. | Identification of conflict rules in a network intent formal equivalence failure |
US10437641B2 (en) | 2017-06-19 | 2019-10-08 | Cisco Technology, Inc. | On-demand processing pipeline interleaved with temporal processing pipeline |
US10498608B2 (en) | 2017-06-16 | 2019-12-03 | Cisco Technology, Inc. | Topology explorer |
US10505816B2 (en) | 2017-05-31 | 2019-12-10 | Cisco Technology, Inc. | Semantic analysis to detect shadowing of rules in a model of network intents |
US10528444B2 (en) | 2017-06-19 | 2020-01-07 | Cisco Technology, Inc. | Event generation in response to validation between logical level and hardware level |
US10536337B2 (en) | 2017-06-19 | 2020-01-14 | Cisco Technology, Inc. | Validation of layer 2 interface and VLAN in a networked environment |
US10547715B2 (en) | 2017-06-16 | 2020-01-28 | Cisco Technology, Inc. | Event generation in response to network intent formal equivalence failures |
US10547509B2 (en) | 2017-06-19 | 2020-01-28 | Cisco Technology, Inc. | Validation of a virtual port channel (VPC) endpoint in the network fabric |
US10554477B2 (en) | 2017-09-13 | 2020-02-04 | Cisco Technology, Inc. | Network assurance event aggregator |
US10554483B2 (en) | 2017-05-31 | 2020-02-04 | Cisco Technology, Inc. | Network policy analysis for networks |
US10554493B2 (en) | 2017-06-19 | 2020-02-04 | Cisco Technology, Inc. | Identifying mismatches between a logical model and node implementation |
US10560355B2 (en) | 2017-06-19 | 2020-02-11 | Cisco Technology, Inc. | Static endpoint validation |
US10560328B2 (en) | 2017-04-20 | 2020-02-11 | Cisco Technology, Inc. | Static network policy analysis for networks |
US10567229B2 (en) | 2017-06-19 | 2020-02-18 | Cisco Technology, Inc. | Validating endpoint configurations between nodes |
US10567228B2 (en) | 2017-06-19 | 2020-02-18 | Cisco Technology, Inc. | Validation of cross logical groups in a network |
US10572495B2 (en) | 2018-02-06 | 2020-02-25 | Cisco Technology Inc. | Network assurance database version compatibility |
US10574513B2 (en) | 2017-06-16 | 2020-02-25 | Cisco Technology, Inc. | Handling controller and node failure scenarios during data collection |
US10581694B2 (en) | 2017-05-31 | 2020-03-03 | Cisco Technology, Inc. | Generation of counter examples for network intent formal equivalence failures |
US10587621B2 (en) | 2017-06-16 | 2020-03-10 | Cisco Technology, Inc. | System and method for migrating to and maintaining a white-list network security model |
US10587456B2 (en) | 2017-09-12 | 2020-03-10 | Cisco Technology, Inc. | Event clustering for a network assurance platform |
US10587484B2 (en) | 2017-09-12 | 2020-03-10 | Cisco Technology, Inc. | Anomaly detection and reporting in a network assurance appliance |
US10616072B1 (en) | 2018-07-27 | 2020-04-07 | Cisco Technology, Inc. | Epoch data interface |
US10623264B2 (en) | 2017-04-20 | 2020-04-14 | Cisco Technology, Inc. | Policy assurance for service chaining |
US10623259B2 (en) | 2017-06-19 | 2020-04-14 | Cisco Technology, Inc. | Validation of layer 1 interface in a network |
US10623271B2 (en) | 2017-05-31 | 2020-04-14 | Cisco Technology, Inc. | Intra-priority class ordering of rules corresponding to a model of network intents |
US10644946B2 (en) | 2017-06-19 | 2020-05-05 | Cisco Technology, Inc. | Detection of overlapping subnets in a network |
US10652102B2 (en) | 2017-06-19 | 2020-05-12 | Cisco Technology, Inc. | Network node memory utilization analysis |
US10659298B1 (en) | 2018-06-27 | 2020-05-19 | Cisco Technology, Inc. | Epoch comparison for network events |
US10673702B2 (en) | 2017-06-19 | 2020-06-02 | Cisco Technology, Inc. | Validation of layer 3 using virtual routing forwarding containers in a network |
US10686669B2 (en) | 2017-06-16 | 2020-06-16 | Cisco Technology, Inc. | Collecting network models and node information from a network |
US10693738B2 (en) | 2017-05-31 | 2020-06-23 | Cisco Technology, Inc. | Generating device-level logical models for a network |
US10700933B2 (en) | 2017-06-19 | 2020-06-30 | Cisco Technology, Inc. | Validating tunnel endpoint addresses in a network fabric |
CN111654491A (en) * | 2020-05-29 | 2020-09-11 | 新华三信息安全技术有限公司 | ACL sharing method, device, equipment and machine readable storage medium |
US10797951B2 (en) | 2014-10-16 | 2020-10-06 | Cisco Technology, Inc. | Discovering and grouping application endpoints in a network environment |
US10805160B2 (en) | 2017-06-19 | 2020-10-13 | Cisco Technology, Inc. | Endpoint bridge domain subnet validation |
US10812315B2 (en) | 2018-06-07 | 2020-10-20 | Cisco Technology, Inc. | Cross-domain network assurance |
US10812318B2 (en) | 2017-05-31 | 2020-10-20 | Cisco Technology, Inc. | Associating network policy objects with specific faults corresponding to fault localizations in large-scale network deployment |
US10812336B2 (en) | 2017-06-19 | 2020-10-20 | Cisco Technology, Inc. | Validation of bridge domain-L3out association for communication outside a network |
US10826788B2 (en) | 2017-04-20 | 2020-11-03 | Cisco Technology, Inc. | Assurance of quality-of-service configurations in a network |
US10826770B2 (en) | 2018-07-26 | 2020-11-03 | Cisco Technology, Inc. | Synthesis of models for networks using automated boolean learning |
US10873509B2 (en) | 2018-01-17 | 2020-12-22 | Cisco Technology, Inc. | Check-pointing ACI network state and re-execution from a check-pointed state |
US10904070B2 (en) | 2018-07-11 | 2021-01-26 | Cisco Technology, Inc. | Techniques and interfaces for troubleshooting datacenter networks |
US10904101B2 (en) | 2017-06-16 | 2021-01-26 | Cisco Technology, Inc. | Shim layer for extracting and prioritizing underlying rules for modeling network intents |
US10911495B2 (en) | 2018-06-27 | 2021-02-02 | Cisco Technology, Inc. | Assurance of security rules in a network |
CN112328369A (en) * | 2020-11-24 | 2021-02-05 | 北京京投信安科技发展有限公司 | Method for processing access rule minimization among multiple virtual machines |
US10943023B2 (en) * | 2016-06-16 | 2021-03-09 | EMC IP Holding Company LLC | Method for filtering documents and electronic device |
US10986131B1 (en) | 2014-12-17 | 2021-04-20 | Amazon Technologies, Inc. | Access control policy warnings and suggestions |
US11019027B2 (en) | 2018-06-27 | 2021-05-25 | Cisco Technology, Inc. | Address translation for external network appliance |
CN112910914A (en) * | 2017-01-18 | 2021-06-04 | 群晖科技股份有限公司 | Router, flow control method and flow monitoring method |
US11044273B2 (en) | 2018-06-27 | 2021-06-22 | Cisco Technology, Inc. | Assurance of security rules in a network |
CN113079097A (en) * | 2021-03-24 | 2021-07-06 | 新华三信息安全技术有限公司 | Message processing method and device |
US20210211473A1 (en) * | 2017-06-07 | 2021-07-08 | Amazon Technologies, Inc. | Dynamic security policy management |
US11102053B2 (en) | 2017-12-05 | 2021-08-24 | Cisco Technology, Inc. | Cross-domain assurance |
US11122042B1 (en) | 2017-05-12 | 2021-09-14 | F5 Networks, Inc. | Methods for dynamically managing user access control and devices thereof |
US11121927B2 (en) | 2017-06-19 | 2021-09-14 | Cisco Technology, Inc. | Automatically determining an optimal amount of time for analyzing a distributed network environment |
US11150973B2 (en) | 2017-06-16 | 2021-10-19 | Cisco Technology, Inc. | Self diagnosing distributed appliance |
US11178150B1 (en) * | 2016-01-20 | 2021-11-16 | F5 Networks, Inc. | Methods for enforcing access control list based on managed application and devices thereof |
US11206264B2 (en) * | 2018-11-30 | 2021-12-21 | Hewlett Packard Enterprise Development Lp | Minimizing traffic leaks during replacement of an access control list for a network interface |
US11218508B2 (en) | 2018-06-27 | 2022-01-04 | Cisco Technology, Inc. | Assurance of security rules in a network |
US11258657B2 (en) | 2017-05-31 | 2022-02-22 | Cisco Technology, Inc. | Fault localization in large-scale network policy deployment |
US11283680B2 (en) | 2017-06-19 | 2022-03-22 | Cisco Technology, Inc. | Identifying components for removal in a network configuration |
CN114422178A (en) * | 2021-12-10 | 2022-04-29 | 锐捷网络股份有限公司 | Statistical result reporting method, device and medium based on access control list |
US11343237B1 (en) | 2017-05-12 | 2022-05-24 | F5, Inc. | Methods for managing a federated identity environment using security and access control data and devices thereof |
US11343150B2 (en) | 2017-06-19 | 2022-05-24 | Cisco Technology, Inc. | Validation of learned routes in a network |
US11350254B1 (en) | 2015-05-05 | 2022-05-31 | F5, Inc. | Methods for enforcing compliance policies and devices thereof |
US11463482B2 (en) * | 2019-03-13 | 2022-10-04 | Forescout Technologies, Inc. | Adaptive access control management |
US11469986B2 (en) | 2017-06-16 | 2022-10-11 | Cisco Technology, Inc. | Controlled micro fault injection on a distributed appliance |
US11645131B2 (en) | 2017-06-16 | 2023-05-09 | Cisco Technology, Inc. | Distributed fault code aggregation across application centric dimensions |
US11706137B2 (en) | 2017-01-18 | 2023-07-18 | Synology Inc. | Routers and methods for traffic management |
US11757946B1 (en) | 2015-12-22 | 2023-09-12 | F5, Inc. | Methods for analyzing network traffic and enforcing network policies and devices thereof |
Citations (26)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6154775A (en) * | 1997-09-12 | 2000-11-28 | Lucent Technologies Inc. | Methods and apparatus for a computer network firewall with dynamic rule processing with the ability to dynamically alter the operations of rules |
US20020194317A1 (en) * | 2001-04-26 | 2002-12-19 | Yasusi Kanada | Method and system for controlling a policy-based network |
US20030115344A1 (en) * | 2001-12-19 | 2003-06-19 | Puqi Tang | Access control management |
US20040193906A1 (en) * | 2003-03-24 | 2004-09-30 | Shual Dar | Network service security |
US7188164B1 (en) * | 2003-02-11 | 2007-03-06 | Cyber Operations, Llc | Secure network access control |
US20080181208A1 (en) * | 2007-01-30 | 2008-07-31 | Oracle International Corporation | Service Driven Smart Router |
US20080186971A1 (en) * | 2007-02-02 | 2008-08-07 | Tarari, Inc. | Systems and methods for processing access control lists (acls) in network switches using regular expression matching logic |
US7506371B1 (en) * | 2004-01-22 | 2009-03-17 | Guardium, Inc. | System and methods for adaptive behavior based access control |
US7506102B2 (en) * | 2006-03-28 | 2009-03-17 | Cisco Technology, Inc. | Method and apparatus for local access authorization of cached resources |
US20090100506A1 (en) * | 2007-10-11 | 2009-04-16 | Steve Whang | System and Method for Managing Network Flows Based on Policy Criteria |
US20100325686A1 (en) * | 2009-06-23 | 2010-12-23 | Yahoo! Inc. | Dynamic access control lists |
US7958549B2 (en) * | 2002-08-20 | 2011-06-07 | Nec Corporation | Attack defending system and attack defending method |
US7983264B2 (en) * | 2007-08-21 | 2011-07-19 | Cyber Operations, Inc. | Access control list management system |
US20110209196A1 (en) * | 2010-02-22 | 2011-08-25 | Avaya Inc. | Flexible security requirements in an enterprise network |
US20110247046A1 (en) * | 2010-03-31 | 2011-10-06 | Gross Thomas R | Access control in data processing systems |
US20110271321A1 (en) * | 2008-12-30 | 2011-11-03 | Andrea Soppera | Access control |
US8094659B1 (en) * | 2007-07-09 | 2012-01-10 | Marvell Israel (M.I.S.L) Ltd. | Policy-based virtual routing and forwarding (VRF) assignment |
US8176146B2 (en) * | 2007-12-14 | 2012-05-08 | At&T Intellectual Property I, Lp | Providing access control list management |
US8223761B2 (en) * | 2004-12-28 | 2012-07-17 | Zte Corporation | Method for diagnosing the router which supports policy-based routing |
US8402538B2 (en) * | 2008-12-03 | 2013-03-19 | Electronics And Telecommunications Research Institute | Method and system for detecting and responding to harmful traffic |
US20130091539A1 (en) * | 2011-10-11 | 2013-04-11 | Honeywell International Inc. | System and method for insider threat detection |
US8490171B2 (en) * | 2008-07-14 | 2013-07-16 | Tufin Software Technologies Ltd. | Method of configuring a security gateway and system thereof |
US20130263206A1 (en) * | 2012-03-30 | 2013-10-03 | Nokia Corporation | Method and apparatus for policy adaption based on application policy compliance analysis |
US20130304917A1 (en) * | 2012-05-10 | 2013-11-14 | Cisco Technology, Inc. | Method and apparatus for supporting access control lists in a multi-tenant environment |
US8839406B2 (en) * | 2012-09-13 | 2014-09-16 | Electronics And Telecommunications Research Institute | Method and apparatus for controlling blocking of service attack by using access control list |
US9038168B2 (en) * | 2009-11-20 | 2015-05-19 | Microsoft Technology Licensing, Llc | Controlling resource access based on resource properties |
-
2013
- 2013-11-19 US US14/084,074 patent/US20140379915A1/en not_active Abandoned
Patent Citations (26)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6154775A (en) * | 1997-09-12 | 2000-11-28 | Lucent Technologies Inc. | Methods and apparatus for a computer network firewall with dynamic rule processing with the ability to dynamically alter the operations of rules |
US20020194317A1 (en) * | 2001-04-26 | 2002-12-19 | Yasusi Kanada | Method and system for controlling a policy-based network |
US20030115344A1 (en) * | 2001-12-19 | 2003-06-19 | Puqi Tang | Access control management |
US7958549B2 (en) * | 2002-08-20 | 2011-06-07 | Nec Corporation | Attack defending system and attack defending method |
US7188164B1 (en) * | 2003-02-11 | 2007-03-06 | Cyber Operations, Llc | Secure network access control |
US20040193906A1 (en) * | 2003-03-24 | 2004-09-30 | Shual Dar | Network service security |
US7506371B1 (en) * | 2004-01-22 | 2009-03-17 | Guardium, Inc. | System and methods for adaptive behavior based access control |
US8223761B2 (en) * | 2004-12-28 | 2012-07-17 | Zte Corporation | Method for diagnosing the router which supports policy-based routing |
US7506102B2 (en) * | 2006-03-28 | 2009-03-17 | Cisco Technology, Inc. | Method and apparatus for local access authorization of cached resources |
US20080181208A1 (en) * | 2007-01-30 | 2008-07-31 | Oracle International Corporation | Service Driven Smart Router |
US20080186971A1 (en) * | 2007-02-02 | 2008-08-07 | Tarari, Inc. | Systems and methods for processing access control lists (acls) in network switches using regular expression matching logic |
US8094659B1 (en) * | 2007-07-09 | 2012-01-10 | Marvell Israel (M.I.S.L) Ltd. | Policy-based virtual routing and forwarding (VRF) assignment |
US7983264B2 (en) * | 2007-08-21 | 2011-07-19 | Cyber Operations, Inc. | Access control list management system |
US20090100506A1 (en) * | 2007-10-11 | 2009-04-16 | Steve Whang | System and Method for Managing Network Flows Based on Policy Criteria |
US8176146B2 (en) * | 2007-12-14 | 2012-05-08 | At&T Intellectual Property I, Lp | Providing access control list management |
US8490171B2 (en) * | 2008-07-14 | 2013-07-16 | Tufin Software Technologies Ltd. | Method of configuring a security gateway and system thereof |
US8402538B2 (en) * | 2008-12-03 | 2013-03-19 | Electronics And Telecommunications Research Institute | Method and system for detecting and responding to harmful traffic |
US20110271321A1 (en) * | 2008-12-30 | 2011-11-03 | Andrea Soppera | Access control |
US20100325686A1 (en) * | 2009-06-23 | 2010-12-23 | Yahoo! Inc. | Dynamic access control lists |
US9038168B2 (en) * | 2009-11-20 | 2015-05-19 | Microsoft Technology Licensing, Llc | Controlling resource access based on resource properties |
US20110209196A1 (en) * | 2010-02-22 | 2011-08-25 | Avaya Inc. | Flexible security requirements in an enterprise network |
US20110247046A1 (en) * | 2010-03-31 | 2011-10-06 | Gross Thomas R | Access control in data processing systems |
US20130091539A1 (en) * | 2011-10-11 | 2013-04-11 | Honeywell International Inc. | System and method for insider threat detection |
US20130263206A1 (en) * | 2012-03-30 | 2013-10-03 | Nokia Corporation | Method and apparatus for policy adaption based on application policy compliance analysis |
US20130304917A1 (en) * | 2012-05-10 | 2013-11-14 | Cisco Technology, Inc. | Method and apparatus for supporting access control lists in a multi-tenant environment |
US8839406B2 (en) * | 2012-09-13 | 2014-09-16 | Electronics And Telecommunications Research Institute | Method and apparatus for controlling blocking of service attack by using access control list |
Cited By (133)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20160134522A1 (en) * | 2013-07-15 | 2016-05-12 | Huawei Technologies Co., Ltd. | Data flow processing method, device, and system |
US10037514B2 (en) * | 2013-12-19 | 2018-07-31 | Centurylink Intellectual Property Llc | Ubiquitous in-cloud microsite generator for high speed data customer intake and activation |
US20150181642A1 (en) * | 2013-12-19 | 2015-06-25 | Centurylink Intellectual Property Llc | Ubiquitous In-Cloud Microsite Generator for High Speed Data Customer Intake and Activation |
US9692766B2 (en) * | 2014-04-04 | 2017-06-27 | International Business Machines Corporation | Validation of a location resource based on recipient access |
US20150288693A1 (en) * | 2014-04-04 | 2015-10-08 | International Business Machines Corporation | Validation of a location resource based on recipient access |
US9398014B2 (en) * | 2014-04-04 | 2016-07-19 | International Business Machines Corporation | Validation of a location resource based on recipient access |
US9407639B2 (en) * | 2014-04-04 | 2016-08-02 | International Business Machines Corporation | Validation of a location resource based on recipient access |
US20150288781A1 (en) * | 2014-04-04 | 2015-10-08 | International Business Machines Corporation | Validation of a location resource based on recipient access |
US20160241568A1 (en) * | 2014-04-04 | 2016-08-18 | International Business Machines Corporation | Validation of a location resource based on recipient access |
US9509700B2 (en) * | 2014-04-09 | 2016-11-29 | Dell Products L.P. | Access control list lockout prevention system |
US9722958B2 (en) * | 2014-07-18 | 2017-08-01 | International Business Machines Corporation | Recommendation of a location resource based on recipient access |
US20160021037A1 (en) * | 2014-07-18 | 2016-01-21 | International Business Machines Corporation | Recommendation of a location resource based on recipient access |
US11539588B2 (en) | 2014-10-16 | 2022-12-27 | Cisco Technology, Inc. | Discovering and grouping application endpoints in a network environment |
US11811603B2 (en) | 2014-10-16 | 2023-11-07 | Cisco Technology, Inc. | Discovering and grouping application endpoints in a network environment |
US10797951B2 (en) | 2014-10-16 | 2020-10-06 | Cisco Technology, Inc. | Discovering and grouping application endpoints in a network environment |
US11824719B2 (en) | 2014-10-16 | 2023-11-21 | Cisco Technology, Inc. | Discovering and grouping application endpoints in a network environment |
US10122757B1 (en) * | 2014-12-17 | 2018-11-06 | Amazon Technologies, Inc. | Self-learning access control policies |
US10986131B1 (en) | 2014-12-17 | 2021-04-20 | Amazon Technologies, Inc. | Access control policy warnings and suggestions |
US10043030B1 (en) | 2015-02-05 | 2018-08-07 | Amazon Technologies, Inc. | Large-scale authorization data collection and aggregation |
US11120154B2 (en) | 2015-02-05 | 2021-09-14 | Amazon Technologies, Inc. | Large-scale authorization data collection and aggregation |
US11350254B1 (en) | 2015-05-05 | 2022-05-31 | F5, Inc. | Methods for enforcing compliance policies and devices thereof |
US11757946B1 (en) | 2015-12-22 | 2023-09-12 | F5, Inc. | Methods for analyzing network traffic and enforcing network policies and devices thereof |
US11178150B1 (en) * | 2016-01-20 | 2021-11-16 | F5 Networks, Inc. | Methods for enforcing access control list based on managed application and devices thereof |
US20170295181A1 (en) * | 2016-04-08 | 2017-10-12 | Balaji PARIMI | Activity based access control in heterogeneous environments |
US10454934B2 (en) * | 2016-04-08 | 2019-10-22 | Cloudknox Security Inc. | Activity based access control in heterogeneous environments |
US10454935B2 (en) | 2016-04-08 | 2019-10-22 | Cloudknox Security Inc. | Method and system to detect discrepancy in infrastructure security configurations from translated security best practice configurations in heterogeneous environments |
US10943023B2 (en) * | 2016-06-16 | 2021-03-09 | EMC IP Holding Company LLC | Method for filtering documents and electronic device |
US11706137B2 (en) | 2017-01-18 | 2023-07-18 | Synology Inc. | Routers and methods for traffic management |
CN112910914A (en) * | 2017-01-18 | 2021-06-04 | 群晖科技股份有限公司 | Router, flow control method and flow monitoring method |
US10623264B2 (en) | 2017-04-20 | 2020-04-14 | Cisco Technology, Inc. | Policy assurance for service chaining |
US10826788B2 (en) | 2017-04-20 | 2020-11-03 | Cisco Technology, Inc. | Assurance of quality-of-service configurations in a network |
US11178009B2 (en) | 2017-04-20 | 2021-11-16 | Cisco Technology, Inc. | Static network policy analysis for networks |
US10560328B2 (en) | 2017-04-20 | 2020-02-11 | Cisco Technology, Inc. | Static network policy analysis for networks |
US11343237B1 (en) | 2017-05-12 | 2022-05-24 | F5, Inc. | Methods for managing a federated identity environment using security and access control data and devices thereof |
US11122042B1 (en) | 2017-05-12 | 2021-09-14 | F5 Networks, Inc. | Methods for dynamically managing user access control and devices thereof |
US11258657B2 (en) | 2017-05-31 | 2022-02-22 | Cisco Technology, Inc. | Fault localization in large-scale network policy deployment |
US10951477B2 (en) | 2017-05-31 | 2021-03-16 | Cisco Technology, Inc. | Identification of conflict rules in a network intent formal equivalence failure |
US11303531B2 (en) | 2017-05-31 | 2022-04-12 | Cisco Technologies, Inc. | Generation of counter examples for network intent formal equivalence failures |
US10623271B2 (en) | 2017-05-31 | 2020-04-14 | Cisco Technology, Inc. | Intra-priority class ordering of rules corresponding to a model of network intents |
US10554483B2 (en) | 2017-05-31 | 2020-02-04 | Cisco Technology, Inc. | Network policy analysis for networks |
US11411803B2 (en) | 2017-05-31 | 2022-08-09 | Cisco Technology, Inc. | Associating network policy objects with specific faults corresponding to fault localizations in large-scale network deployment |
US10581694B2 (en) | 2017-05-31 | 2020-03-03 | Cisco Technology, Inc. | Generation of counter examples for network intent formal equivalence failures |
US10812318B2 (en) | 2017-05-31 | 2020-10-20 | Cisco Technology, Inc. | Associating network policy objects with specific faults corresponding to fault localizations in large-scale network deployment |
US10693738B2 (en) | 2017-05-31 | 2020-06-23 | Cisco Technology, Inc. | Generating device-level logical models for a network |
US10439875B2 (en) | 2017-05-31 | 2019-10-08 | Cisco Technology, Inc. | Identification of conflict rules in a network intent formal equivalence failure |
US10505816B2 (en) | 2017-05-31 | 2019-12-10 | Cisco Technology, Inc. | Semantic analysis to detect shadowing of rules in a model of network intents |
US20220217182A1 (en) * | 2017-06-07 | 2022-07-07 | Amazon Technologies, Inc. | Dynamic security policy management |
US11683349B2 (en) * | 2017-06-07 | 2023-06-20 | Amazon Technologies, Inc. | Dynamic security policy management |
US20210211473A1 (en) * | 2017-06-07 | 2021-07-08 | Amazon Technologies, Inc. | Dynamic security policy management |
US11150973B2 (en) | 2017-06-16 | 2021-10-19 | Cisco Technology, Inc. | Self diagnosing distributed appliance |
US11102337B2 (en) | 2017-06-16 | 2021-08-24 | Cisco Technology, Inc. | Event generation in response to network intent formal equivalence failures |
US10498608B2 (en) | 2017-06-16 | 2019-12-03 | Cisco Technology, Inc. | Topology explorer |
US10547715B2 (en) | 2017-06-16 | 2020-01-28 | Cisco Technology, Inc. | Event generation in response to network intent formal equivalence failures |
US10686669B2 (en) | 2017-06-16 | 2020-06-16 | Cisco Technology, Inc. | Collecting network models and node information from a network |
US11469986B2 (en) | 2017-06-16 | 2022-10-11 | Cisco Technology, Inc. | Controlled micro fault injection on a distributed appliance |
US10587621B2 (en) | 2017-06-16 | 2020-03-10 | Cisco Technology, Inc. | System and method for migrating to and maintaining a white-list network security model |
US11563645B2 (en) | 2017-06-16 | 2023-01-24 | Cisco Technology, Inc. | Shim layer for extracting and prioritizing underlying rules for modeling network intents |
US11645131B2 (en) | 2017-06-16 | 2023-05-09 | Cisco Technology, Inc. | Distributed fault code aggregation across application centric dimensions |
US10904101B2 (en) | 2017-06-16 | 2021-01-26 | Cisco Technology, Inc. | Shim layer for extracting and prioritizing underlying rules for modeling network intents |
US10574513B2 (en) | 2017-06-16 | 2020-02-25 | Cisco Technology, Inc. | Handling controller and node failure scenarios during data collection |
US11463316B2 (en) | 2017-06-16 | 2022-10-04 | Cisco Technology, Inc. | Topology explorer |
US10873505B2 (en) | 2017-06-19 | 2020-12-22 | Cisco Technology, Inc. | Validation of layer 2 interface and VLAN in a networked environment |
US11121927B2 (en) | 2017-06-19 | 2021-09-14 | Cisco Technology, Inc. | Automatically determining an optimal amount of time for analyzing a distributed network environment |
US10437641B2 (en) | 2017-06-19 | 2019-10-08 | Cisco Technology, Inc. | On-demand processing pipeline interleaved with temporal processing pipeline |
US10862752B2 (en) | 2017-06-19 | 2020-12-08 | Cisco Technology, Inc. | Network validation between the logical level and the hardware level of a network |
US10873506B2 (en) | 2017-06-19 | 2020-12-22 | Cisco Technology, Inc. | Validation of a virtual port channel (VPC) endpoint in the network fabric |
US10528444B2 (en) | 2017-06-19 | 2020-01-07 | Cisco Technology, Inc. | Event generation in response to validation between logical level and hardware level |
US11469952B2 (en) | 2017-06-19 | 2022-10-11 | Cisco Technology, Inc. | Identifying mismatches between a logical model and node implementation |
US10880169B2 (en) | 2017-06-19 | 2020-12-29 | Cisco Technology, Inc. | Multiprotocol border gateway protocol routing validation |
US10218572B2 (en) | 2017-06-19 | 2019-02-26 | Cisco Technology, Inc. | Multiprotocol border gateway protocol routing validation |
US10805160B2 (en) | 2017-06-19 | 2020-10-13 | Cisco Technology, Inc. | Endpoint bridge domain subnet validation |
US10432467B2 (en) | 2017-06-19 | 2019-10-01 | Cisco Technology, Inc. | Network validation between the logical level and the hardware level of a network |
US10536337B2 (en) | 2017-06-19 | 2020-01-14 | Cisco Technology, Inc. | Validation of layer 2 interface and VLAN in a networked environment |
US10333787B2 (en) | 2017-06-19 | 2019-06-25 | Cisco Technology, Inc. | Validation of L3OUT configuration for communications outside a network |
US10700933B2 (en) | 2017-06-19 | 2020-06-30 | Cisco Technology, Inc. | Validating tunnel endpoint addresses in a network fabric |
US10972352B2 (en) | 2017-06-19 | 2021-04-06 | Cisco Technology, Inc. | Validation of routing information base-forwarding information base equivalence in a network |
US10673702B2 (en) | 2017-06-19 | 2020-06-02 | Cisco Technology, Inc. | Validation of layer 3 using virtual routing forwarding containers in a network |
US11750463B2 (en) | 2017-06-19 | 2023-09-05 | Cisco Technology, Inc. | Automatically determining an optimal amount of time for analyzing a distributed network environment |
US10812336B2 (en) | 2017-06-19 | 2020-10-20 | Cisco Technology, Inc. | Validation of bridge domain-L3out association for communication outside a network |
US11438234B2 (en) | 2017-06-19 | 2022-09-06 | Cisco Technology, Inc. | Validation of a virtual port channel (VPC) endpoint in the network fabric |
US11736351B2 (en) | 2017-06-19 | 2023-08-22 | Cisco Technology Inc. | Identifying components for removal in a network configuration |
US10341184B2 (en) | 2017-06-19 | 2019-07-02 | Cisco Technology, Inc. | Validation of layer 3 bridge domain subnets in in a network |
US10652102B2 (en) | 2017-06-19 | 2020-05-12 | Cisco Technology, Inc. | Network node memory utilization analysis |
US11063827B2 (en) | 2017-06-19 | 2021-07-13 | Cisco Technology, Inc. | Validation of layer 3 bridge domain subnets in a network |
US10644946B2 (en) | 2017-06-19 | 2020-05-05 | Cisco Technology, Inc. | Detection of overlapping subnets in a network |
US11102111B2 (en) | 2017-06-19 | 2021-08-24 | Cisco Technology, Inc. | Validation of routing information in a network fabric |
US10547509B2 (en) | 2017-06-19 | 2020-01-28 | Cisco Technology, Inc. | Validation of a virtual port channel (VPC) endpoint in the network fabric |
US11405278B2 (en) | 2017-06-19 | 2022-08-02 | Cisco Technology, Inc. | Validating tunnel endpoint addresses in a network fabric |
US10623259B2 (en) | 2017-06-19 | 2020-04-14 | Cisco Technology, Inc. | Validation of layer 1 interface in a network |
US11558260B2 (en) | 2017-06-19 | 2023-01-17 | Cisco Technology, Inc. | Network node memory utilization analysis |
US10348564B2 (en) | 2017-06-19 | 2019-07-09 | Cisco Technology, Inc. | Validation of routing information base-forwarding information base equivalence in a network |
US10554493B2 (en) | 2017-06-19 | 2020-02-04 | Cisco Technology, Inc. | Identifying mismatches between a logical model and node implementation |
US11153167B2 (en) | 2017-06-19 | 2021-10-19 | Cisco Technology, Inc. | Validation of L3OUT configuration for communications outside a network |
US11343150B2 (en) | 2017-06-19 | 2022-05-24 | Cisco Technology, Inc. | Validation of learned routes in a network |
US10560355B2 (en) | 2017-06-19 | 2020-02-11 | Cisco Technology, Inc. | Static endpoint validation |
US10411996B2 (en) | 2017-06-19 | 2019-09-10 | Cisco Technology, Inc. | Validation of routing information in a network fabric |
US11595257B2 (en) | 2017-06-19 | 2023-02-28 | Cisco Technology, Inc. | Validation of cross logical groups in a network |
US10567228B2 (en) | 2017-06-19 | 2020-02-18 | Cisco Technology, Inc. | Validation of cross logical groups in a network |
US11283682B2 (en) | 2017-06-19 | 2022-03-22 | Cisco Technology, Inc. | Validation of bridge domain-L3out association for communication outside a network |
US11283680B2 (en) | 2017-06-19 | 2022-03-22 | Cisco Technology, Inc. | Identifying components for removal in a network configuration |
US11303520B2 (en) | 2017-06-19 | 2022-04-12 | Cisco Technology, Inc. | Validation of cross logical groups in a network |
US10567229B2 (en) | 2017-06-19 | 2020-02-18 | Cisco Technology, Inc. | Validating endpoint configurations between nodes |
US11570047B2 (en) | 2017-06-19 | 2023-01-31 | Cisco Technology, Inc. | Detection of overlapping subnets in a network |
US11038743B2 (en) | 2017-09-12 | 2021-06-15 | Cisco Technology, Inc. | Event clustering for a network assurance platform |
US10587456B2 (en) | 2017-09-12 | 2020-03-10 | Cisco Technology, Inc. | Event clustering for a network assurance platform |
US10587484B2 (en) | 2017-09-12 | 2020-03-10 | Cisco Technology, Inc. | Anomaly detection and reporting in a network assurance appliance |
US11115300B2 (en) | 2017-09-12 | 2021-09-07 | Cisco Technology, Inc | Anomaly detection and reporting in a network assurance appliance |
US10554477B2 (en) | 2017-09-13 | 2020-02-04 | Cisco Technology, Inc. | Network assurance event aggregator |
US10333833B2 (en) | 2017-09-25 | 2019-06-25 | Cisco Technology, Inc. | Endpoint path assurance |
US11102053B2 (en) | 2017-12-05 | 2021-08-24 | Cisco Technology, Inc. | Cross-domain assurance |
US11824728B2 (en) | 2018-01-17 | 2023-11-21 | Cisco Technology, Inc. | Check-pointing ACI network state and re-execution from a check-pointed state |
US10873509B2 (en) | 2018-01-17 | 2020-12-22 | Cisco Technology, Inc. | Check-pointing ACI network state and re-execution from a check-pointed state |
US10572495B2 (en) | 2018-02-06 | 2020-02-25 | Cisco Technology Inc. | Network assurance database version compatibility |
US11374806B2 (en) | 2018-06-07 | 2022-06-28 | Cisco Technology, Inc. | Cross-domain network assurance |
US10812315B2 (en) | 2018-06-07 | 2020-10-20 | Cisco Technology, Inc. | Cross-domain network assurance |
US11902082B2 (en) | 2018-06-07 | 2024-02-13 | Cisco Technology, Inc. | Cross-domain network assurance |
US10659298B1 (en) | 2018-06-27 | 2020-05-19 | Cisco Technology, Inc. | Epoch comparison for network events |
US11909713B2 (en) | 2018-06-27 | 2024-02-20 | Cisco Technology, Inc. | Address translation for external network appliance |
US11218508B2 (en) | 2018-06-27 | 2022-01-04 | Cisco Technology, Inc. | Assurance of security rules in a network |
US11888603B2 (en) | 2018-06-27 | 2024-01-30 | Cisco Technology, Inc. | Assurance of security rules in a network |
US11044273B2 (en) | 2018-06-27 | 2021-06-22 | Cisco Technology, Inc. | Assurance of security rules in a network |
US11019027B2 (en) | 2018-06-27 | 2021-05-25 | Cisco Technology, Inc. | Address translation for external network appliance |
US10911495B2 (en) | 2018-06-27 | 2021-02-02 | Cisco Technology, Inc. | Assurance of security rules in a network |
US11805004B2 (en) | 2018-07-11 | 2023-10-31 | Cisco Technology, Inc. | Techniques and interfaces for troubleshooting datacenter networks |
US10904070B2 (en) | 2018-07-11 | 2021-01-26 | Cisco Technology, Inc. | Techniques and interfaces for troubleshooting datacenter networks |
US10826770B2 (en) | 2018-07-26 | 2020-11-03 | Cisco Technology, Inc. | Synthesis of models for networks using automated boolean learning |
US10616072B1 (en) | 2018-07-27 | 2020-04-07 | Cisco Technology, Inc. | Epoch data interface |
US11206264B2 (en) * | 2018-11-30 | 2021-12-21 | Hewlett Packard Enterprise Development Lp | Minimizing traffic leaks during replacement of an access control list for a network interface |
US11463482B2 (en) * | 2019-03-13 | 2022-10-04 | Forescout Technologies, Inc. | Adaptive access control management |
CN111654491A (en) * | 2020-05-29 | 2020-09-11 | 新华三信息安全技术有限公司 | ACL sharing method, device, equipment and machine readable storage medium |
CN112328369A (en) * | 2020-11-24 | 2021-02-05 | 北京京投信安科技发展有限公司 | Method for processing access rule minimization among multiple virtual machines |
CN113079097A (en) * | 2021-03-24 | 2021-07-06 | 新华三信息安全技术有限公司 | Message processing method and device |
CN114422178A (en) * | 2021-12-10 | 2022-04-29 | 锐捷网络股份有限公司 | Statistical result reporting method, device and medium based on access control list |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20140379915A1 (en) | Cloud based dynamic access control list management architecture | |
US11539576B2 (en) | Dynamic path selection and data flow forwarding | |
US11811731B2 (en) | Packet classification for network routing | |
JP5880560B2 (en) | Communication system, forwarding node, received packet processing method and program | |
US20210377270A1 (en) | Methods And Systems For Dynamic Creation Of Access Control Lists | |
US20160080263A1 (en) | Sdn-based service chaining system | |
CN107426007B (en) | Method and system for tracking network device information in a network switch |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: CISCO TECHNOLOGY, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:YANG, LING;XIE, YIJIE;REEL/FRAME:031632/0922 Effective date: 20131118 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |